{"id":170538,"date":"2026-05-09T00:24:31","date_gmt":"2026-05-08T22:24:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/predlozhen-killswitch-dlya-ekstrennogo-otklyucheniya-uyazvimoj-funkczionalnosti-v-yadre-linux"},"modified":"2026-05-09T00:24:31","modified_gmt":"2026-05-08T22:24:31","slug":"predlozhen-killswitch-dlya-ekstrennogo-otklyucheniya-uyazvimoj-funkczionalnosti-v-yadre-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/predlozhen-killswitch-dlya-ekstrennogo-otklyucheniya-uyazvimoj-funkczionalnosti-v-yadre-linux","title":{"rendered":"A killswitch has been proposed for the emergency disabling of vulnerable functionality in the Linux kernel.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Sasha Levin from NVIDIA, who is responsible for maintaining the LTS branches of the Linux kernel and is a member of the advisory board of the Linux Foundation, has prepared a set of patches implementing a killswitch mechanism for the Linux kernel. This proposed feature allows for the immediate disabling of access to specific functionalities of the running kernel. It is expected that the killswitch will be useful for temporarily blocking vulnerabilities until a kernel update with a fix is installed. <\/p>\n
The killswitch is managed through the file \"\/sys\/kernel\/security\/killswitch\/control\", which allows you to configure the interception of calls to kernel functions by their names. For example, to block the Copy Fail vulnerability, you simply need to write the command \"engage af_alg_sendmsg -1\" in the control file to enable interception of the af_alg_sendmsg function call and return the error code \"-1\" instead of executing it. <\/p>\n
Any characters supported by the kprobes subsystem can be used as names. Many recently discovered serious vulnerabilities in the kernel are present in subsystems used by a relatively small number of users (for example, AF_ALG, ksmbd, nf_tables, vsock, ax25). For most users, the inconvenience of disabling specific functions does not compare to the risk of operating the kernel with a known unpatched vulnerability until a fix is installed. The killswitch mechanism is particularly relevant in the context of today\u2019s Dirty Frag vulnerability, for which an exploit was released before the issue was resolved in the kernel. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"